2398 matches found
Custom Permalinks <= 1.1 - Cross-Site Scripting (XSS)
User controllable input in the admin page of Custom Permalinks gets output without any escaping. URL/wp-admin/admin.php?page=custom-permalinks-post-permalinks&s=alert1...
Custom Permalinks <= 1.1 - Authenticated SQL Injection
Missing checking of user controllable input during Bulk Action in the Custom Permalinks backend page leads to SQL injection vulnerability. Send authenticated POST request to "URL/wp-admin/admin.php?page=custom-permalinks-post-permalinks" with parameters "action=delete&permalinks=1 PAYLOAD -- "...
Code injection
CMS Made Simple CMSMS 2.2.5 has XSS in admin/addbookmark.php via the title parameter...
WordPress booking-calendar plugin cross-site request forgery vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. booking-calendar plugin is used in one of the online booking plugin. A cross-site request forgery vulnerability...
CVE-2018-5690
Cross-site scripting XSS vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the nb parameter aka the page limit number...
CVE-2018-5673
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php...
Design/Logic Flaw
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bgcolor parameter...
Design/Logic Flaw
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php socialicon1 parameter...
CVE-2018-5310
In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-search-register URI...
CVE-2018-5311
The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjooecaeoptionscustomcss parameter to the wp-admin/admin.php?page=tonjooexcerpt URI...
SQL injection vulnerability in phpaaCMS v0.5 category.action.php page
phpaaCMS is a simple article management system. A SQL injection vulnerability exists in the /admin/category.action.php page of phpaaCMS v0.5, which can be exploited by attackers to obtain sensitive database information...
CVE-2018-5286
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page...
CVE-2018-5288
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page...
CVE-2018-5289
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page...
CVE-2018-5073
Online Ticket Booking has CSRF via admin/movieedit.php...
Cross site request forgery (csrf)
Online Ticket Booking has CSRF via admin/movieedit.php...
CVE-2018-5078
Online Ticket Booking has XSS via the admin/eventlist.php cast parameter...
CVE-2017-17985
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/stateview.php couid parameter...